PT-2022-24070 · Phicomm · Phicomm Fir300B A2+3

Published 2022-09-07 · Updated 2022-09-12 · CVE-2022-37780

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers version 3.0.1.17

Description The issue is related to a remote command execution vulnerability. This vulnerability can be exploited via the pingAddr parameter of the tracert function.

Recommendations For Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers version 3.0.1.17, consider restricting access to the tracert function to minimize the risk of exploitation. Avoid using the pingAddr parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-37780

Affected Products

Phicomm Fir151B A2

Phicomm Fir300B A2

Phicomm Fir302E A2

Phicomm Fir303B A2

References · 4

• 🔥 https://github.com/SLoSnow9879/Phicomm_Router/blob/main/Tracert_1.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-37780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37780 · Security Note
• https://t.me/cibsecurity/49402 · Telegram Post